Is it possible for a web server to make a HTTPS request to itself?

Question

Imagine you have two applications, A & B, running on the same web server. You want app A to call a webService on app B over SSL.

Is it possible to do that with an address like https://localhost/appsB/webService1?

How can the SSL handshake be done without a client (like a browser?) It actually works when using this address http://localhost/appsB/webService1, only not in SSL mode.

However it works as well with HTTPS between the server and a browser when calling https://localhost/appsB/webService1.

Now, the strange thing is that it works sometimes but randomly fails when calling the webService on app B using HTTPS. Using HTTP it always works.

My tests are on IIS7.0 with a valid ssl certificate from Thawte with SSL option not required for app B.

Here is an exemple of my code :

string baseAddress = "http://localhost";
//or string baseAddress = "https://localhost";
var baseUri = new Uri(baseAddress);
//final url for appB
finalUrl = baseAddress + httpContext.Current.Request.ApplicationPath.TrimEnd('/') + "/" + url;
//Add a cookie to retrieve good contexte on appB
var cookieContainer = new CookieContainer();
using (var handler = new HttpClientHandler() { CookieContainer = cookieContainer })
using (var client = new HttpClient(handler) { BaseAddress = baseUri })
{
  cookieContainer.Add(baseUri, new Cookie("ASP.NET_SessionId", HttpContext.Current.Session.SessionID));
  HttpResponseMessage response = client.GetAsync(finalUrl).Result;
  Dictionary<string, dynamic> sData;
if (response.IsSuccessStatusCode)
{
    etc, etc..
}

if you mean redirect client to another link you can do it with iis redirect very simple just add feature — Soheil, Mar 24 '15 at 16:04
No, i mean making a https request from server to same server but different apps ;) — Guillaume Réan, Mar 24 '15 at 18:04
you generate certificate for *.somesite.com that certificate for all file relevant to your site or application — Soheil, Mar 24 '15 at 18:08
The certificate is for one site whither the two apps have been installed. But i think my explainations are bad.. I simply want to know if an appA can request an appB on the same site AND on the same webServer. It's a request by a server to itself in HTTPS but to a different app. It works in http but not in https and i wonder why.. maybe requesting an https protocol to a localhost request is totally useless but i didn't find any proof of it in documentation.. — Guillaume Réan, Mar 25 '15 at 08:21
It is possible to write an app to access https on localhost. Can you post the code that isn't working? You may need to provide custom hostname validation logic in the appA...something like this: http://stackoverflow.com/questions/2675133/c-sharp-ignore-certificate-errors — Grady G Cooper, Mar 26 '15 at 00:34

score 2 · Answer 1 · answered May 22 '17 at 21:01

All you have to do is create a https client in server A to talk to talk to itself. Below is my code. In my case, it is a client in server A that talks to a webserver interface on Server A. In this case, I am measuring my servers latency performance.

// Get Administration Server Status
    public String adminServerStatus() {

        uri = "https://" + "localhost" + ":" + adminserverport + "/home";
        result = "grn";
        adminlatency = 0;

        // Build httpHeader entity
        HttpHeaders headers = new HttpHeaders();
        HttpEntity<String> httpentity = new HttpEntity<String>(headers);

        try {

            // Build the httpClient
            TrustStrategy acceptingTrustStrategy = (X509Certificate[] chain, String authType) -> true;
            SSLContext sslContext = org.apache.http.ssl.SSLContexts.custom()
                .loadTrustMaterial(null, acceptingTrustStrategy)
                .build();

            SSLConnectionSocketFactory csf = new SSLConnectionSocketFactory(sslContext);
            CloseableHttpClient httpClient = HttpClients.custom()
                .setSSLSocketFactory(csf)
                .build();

            // Build httpClient template
            HttpComponentsClientHttpRequestFactory requestFactory =
                new HttpComponentsClientHttpRequestFactory();
            requestFactory.setHttpClient(httpClient);               
            RestTemplate template = new RestTemplate(requestFactory);

            // Now go fire client status request & get latency duration
            timenow = System.currentTimeMillis();
            ResponseEntity<String> httpresult = template.exchange(uri, HttpMethod.GET, httpentity, String.class);
            adminlatency = System.currentTimeMillis() - timenow;

            HttpStatus statuscode = httpresult.getStatusCode();
            if (statuscode != HttpStatus.OK) {
                result = "yel";
                adminlatency = 0;
            }

            httpClient.close();

        // Error Caught
        } catch (Exception e) {
            result = "red";
            adminlatency = 0;
        }

        return result;
    }

Is it possible for a web server to make a HTTPS request to itself?

1 Answers1

Linked